Daily Archives: December 7, 2017

System76 will disable Intel Management engine on its Linux laptops via firmware update

Posted on by

System76 is one a handful of companies that sells computers that run Linux software out of the box. But like most PCs that have shipped with Intel’s Core processors in the past few years, System76 laptops include Intel’s Management Engine firmware.

Intel recently confirmed a major security vulnerability affecting those chips and it’s working with PC makers to patch that vulnerability.

But System76 is taking another approach: it’s going to roll out a firmware update for its recent laptops that disables the Intel Management Engine altogether.

Technically, that’s not something Intel wants you to do. Not only does the chip maker not tell you what’s in the code, but it doesn’t provide an off switch.

But independent researchers have recently discovered a way to disable the Intel Management Engine and companies including Google and Purism have already announced plans to do so.

What’s noteworthy in the System76 announcement is that the PC maker isn’t just planning to disable Intel ME in computers that ship from now on. The company will send out an update that disables it on existing computers with 6th, 7th, or 8th-gen Intel Core processors. System76 also notes that Intel ME “provides no functionality for System76 laptop customers and is safe to disable.”

Source: System76 will disable Intel Management engine on its Linux laptops – Liliputing

Come on Lenovo – do this for me too!

Don’t Buy Anyone an Echo

Posted on by

Let me make this point dreadfully clear, though: Your family members do not need an Amazon Echo or a Google Home or an Apple HomePod or whatever that one smart speaker that uses Cortana is called. And you don’t either. You only want one because every single gadget-slinger on the planet is marketing them to you as an all-new, life-changing device that could turn your kitchen into a futuristic voice-controlled paradise. You probably think that having an always-on microphone in your home is fine, and furthermore, tech companies only record and store snippets of your most intimate conversations. No big deal, you tell yourself.

Actually, it is a big deal. The newfound privacy conundrum presented by installing a device that can literally listen to everything you’re saying represents a chilling new development in the age of internet-connected things. By buying a smart speaker, you’re effectively paying money to let a huge tech company surveil you. And I don’t mean to sound overly cynical about this, either. Amazon, Google, Apple, and others say that their devices aren’t spying on unsuspecting families. The only problem is that these gadgets are both hackable and prone to bugs.

Before getting into the truly scary stuff, though, let’s talk a little bit about utility. Any internet-connected thing that you bring into your home should make your life easier. Philips Hue bulbs, for instance, let you dim the lights in an app. Easy! A Nest thermostat learns your habits so you don’t have to turn up the heat as often. Cool! An Amazon Echo or a Google Home, well, they talk to you, and if you’re lucky, you might be able to figure out how to talk back in the right way and do random things around the house. Huh?

Source: Don’t Buy Anyone an Echo

A good and concise explanation of why these useless devices are something to be very afraid of.

Mailsploit: It’s 2017, and you can spoof the ‘from’ in email to fool filters

Posted on by

Penetration tester Sabri Haddouche has reintroduced the world to email source spoofing, bypassing spam filters and protections like Domain-based Message Authentication, Reporting and Conformance (DMARC), thereby posing a risk to anyone running a vulnerable and unpatched mail client.What he’s found is that more than 30 mail clients including Apple Mail, Thunderbird, various Windows clients, Yahoo! Mail, ProtonMail and more bungled their implementation of an ancient RFC, letting an attacker trick the software into displaying a spoofed from field, even though what the server sees is the real sender.That means if the server is configured to use DMARC, Sender Policy Framework(SPF) or Domain Keys Identified Mail (DKIM), it will treat a message as legit, even if it should be spam-binned.

Source: Mailsploit: It’s 2017, and you can spoof the ‘from’ in email to fool filters • The Register

Bitcoin could cost us our clean-energy future

Posted on by

If you’re like me, you’ve probably been ignoring the bitcoin phenomenon for years — because it seemed too complex, far-fetched, or maybe even too libertarian. But if you have any interest in a future where the world moves beyond fossil fuels, you and I should both start paying attention now.Last week, the value of a single bitcoin broke the $10,000 barrier for the first time. Over the weekend, the price nearly hit $12,000. At the beginning of this year, it was less than $1,000.
[…]
But what they might not have accounted for is how much of an energy suck the computer network behind bitcoin could one day become. Simply put, bitcoin is slowing the effort to achieve a rapid transition away from fossil fuels. What’s more, this is just the beginning. Given its rapidly growing climate footprint, bitcoin is a malignant development, and it’s getting worse.
[…]
Digital financial transactions come with a real-world price: The tremendous growth of cryptocurrencies has created an exponential demand for computing power. As bitcoin grows, the math problems computers must solve to make more bitcoin (a process called “mining”) get more and more difficult — a wrinkle designed to control the currency’s supply.

Today, each bitcoin transaction requires the same amount of energy used to power nine homes in the U.S. for one day. And miners are constantly installing more and faster computers. Already, the aggregate computing power of the bitcoin network is nearly 100,000 times larger than the world’s 500 fastest supercomputers combined.

The total energy use of this web of hardware is huge — an estimated 31 terawatt-hours per year. More than 150 individual countries in the world consume less energy annually. And that power-hungry network is currently increasing its energy use every day by about 450 gigawatt-hours, roughly the same amount of electricity the entire country of Haiti uses in a year.

That sort of electricity use is pulling energy from grids all over the world, where it could be charging electric vehicles and powering homes, to bitcoin-mining farms. In Venezuela, where rampant hyperinflation and subsidized electricity has led to a boom in bitcoin mining, rogue operations are now occasionally causing blackouts across the country. The world’s largest bitcoin mines are in China, where they siphon energy from huge hydroelectric dams, some of the cheapest sources of carbon-free energy in the world. One enterprising Tesla owner even attempted to rig up a mining operation in his car, to make use of free electricity at a public charging station.

In just a few months from now, at bitcoin’s current growth rate, the electricity demanded by the cryptocurrency network will start to outstrip what’s available, requiring new energy-generating plants. And with the climate conscious racing to replace fossil fuel-base plants with renewable energy sources, new stress on the grid means more facilities using dirty technologies. By July 2019, the bitcoin network will require more electricity than the entire United States currently uses. By February 2020, it will use as much electricity as the entire world does today.

Source: Bitcoin could cost us our clean-energy future | Grist

DeepMind’s AI became a superhuman chess (and shogi and go) player in a few hours using generic reinforcement learning

Posted on by

In the paper, DeepMind describes how a descendant of the AI program that first conquered the board game Go has taught itself to play a number of other games at a superhuman level. After eight hours of self-play, the program bested the AI that first beat the human world Go champion; and after four hours of training, it beat the current world champion chess-playing program, Stockfish. Then for a victory lap, it trained for just two hours and polished off one of the world’s best shogi-playing programs named Elmo (shogi being a Japanese version of chess that’s played on a bigger board).

One of the key advances here is that the new AI program, named AlphaZero, wasn’t specifically designed to play any of these games. In each case, it was given some basic rules (like how knights move in chess, and so on) but was programmed with no other strategies or tactics. It simply got better by playing itself over and over again at an accelerated pace — a method of training AI known as “reinforcement learning.

”Using reinforcement learning in this way isn’t new in and of itself. DeepMind’s engineers used the same method to create AlphaGo Zero; the AI program that was unveiled this October. But, as this week’s paper describes, the new AlphaZero is a “more generic version” of the same software, meaning it can be applied to a broader range of tasks without being primed beforehand.What’s remarkable here is that in less than 24 hours, the same computer program was able to teach itself how to play three complex board games at superhuman levels. That’s a new feat for the world of AI.

Source: DeepMind’s AI became a superhuman chess player in a few hours – The Verge

NiceHash Hacked, $62 Million of Bitcoin May Be Stolen

Posted on by

New submitter Chir breaks the news to us that the NiceHash crypto-mining marketplace has been hacked. The crypto mining pool broke the news on Reddit, where users suggest that as many as 4,736.42 BTC — an amount worth more than $62 million at current prices — has been stolen. The NiceHash team is urging users to change their online passwords as a result of the breach and theft.

Source: NiceHash Hacked, $62 Million of Bitcoin May Be Stolen – Slashdot

Asus NovaGo: laptop built on an ARM mobile phone processor runs Windows

Posted on by

A 2-in-1 Windows 10 laptop powered by a smartphone chip

The chipset behind the Asus NovaGo comes straight from smartphones, so we were into the fact that the volume and power keys are aligned along the right side of the laptop. This is shaping up to be the always-connected laptop counterpart to a smartphone in so many ways.
[…]
The Asus NovaGo presents a glimpse of an always-connected laptop future with what promises to be stellar battery life, mixed with last year’s smartphone chipset and older ports.

It has us excited for what this laptop eliminates more than it introduces. Not having to connect to unsecure Wi-Fi, setup a hotspot or worry as much about battery life is a brilliant change that makes it possible to use this laptop anyway.

Performance is the wildcard. How does Qualcomm’s smartphone chipset backed by a lot of RAM compare to laptop that have the usual Intel CPUs at the heart?

That’s going to require more testing of the Asus NovaGo in a full review coming soon.

Source: Asus NovaGo hands on review | TechRadar

And no leaky backdoor installed in the form of Intel management engine

The Underground Uber Networks Driven by Russian Hackers

Posted on by

Uber’s ride-sharing service has given birth to some of the most creative criminal scams to date, including using a GPS-spoofing app to rip off riders in Nigeria, and even ginning up fake drivers by using stolen identities.Add to those this nefariously genius operation: Cybercriminals, many working in Russia, have created their own illegitimate taxi services for other crooks by piggybacking off Uber’s ride-sharing platform, sometimes working in collaboration with corrupt drivers.Based on several Russian-language posts across a number of criminal-world sites, this is how the scam works: The scammer needs an emulator, a piece of software which allows them to run a virtual Android phone on their laptop with the Uber app, as well as a virtual private network (VPN), which routes their computer’s traffic through a server in the same city as the rider.The scammer acts, in essence, as a middleman between an Uber driver and the passenger—ordering trips through the Uber app, but relaying messages outside of it. Typically, this fraudulent dispatcher uses the messaging app Telegram to chat with the passenger, who provides pickup and destination addresses. The scammer orders the trip, and then provides the car brand, driver name, and license plate details back to the passenger through Telegram.In one Russian-language crime-forum post, a scammer says their service runs in some 20 cities, including Moscow and St. Petersburg, as well as Kiev in Ukraine and Minsk in Belarus; another thread suggests the service has been used in New York and Portugal as well.In some cases, the scam middleman will use an Uber promotional code or voucher for a free or discounted ride—meaning they’d just pocket whatever fee charged to the passenger. In another variation of the scheme, some scammers are working with drivers to split profits—one post explicitly says the scammer cooperates with drivers.

Source: The Underground Uber Networks Driven by Russian Hackers

Scientists Added Two New Letters to DNA’s Code

Posted on by

Back in 2014, scientists at the Scripps Research Institute in California reported that they’d engineered bacteria whose DNA used a whole new pair of letters, nicknamed X and Y. That same team now reports that they’ve gotten the bacteria to actually use these new letters. The biological possibilities, as a result, now seem endless.“The resulting semi-synthetic organism both encodes and retrieves increased information,” report the authors this week in Nature, “and should serve as a platform for the creation of new life forms and functions,” like new kinds of bacteria with specialized purposes (cleaning the environment, storing gifs…who knows) for example.

Source: Scientists Added Two New Letters to DNA’s Code

This frostbitten black metal album was created by an artificial intelligence

Posted on by

Coditany of Timeness” is a convincing lo-fi black metal album, complete with atmospheric interludes, tremolo guitar, frantic blast beats and screeching vocals. But the record, which you can listen to on Bandcamp, wasn’t created by musicians.Instead, it was generated by two musical technologists using a deep learning software that ingests a musical album, processes it, and spits out an imitation of its style.To create Coditany, the software broke “Diotima,” a 2011 album by a New York black metal band called Krallice, into small segments of audio. Then they fed each segment through a neural network — a type of artificial intelligence modeled loosely on a biological brain — and asked it to guess what the waveform of the next individual sample of audio would be. If the guess was right, the network would strengthen the paths of the neural network that led to the correct answer, similar to the way electrical connections between neurons in our brain strengthen as we learn new skills.At first the network just produced washes of textured noise. “Early in its training, the kinds of sounds it produces are very noisy and grotesque and textural,” said CJ Carr, one of the creators of the algorithm. But as it moved through guesses — as many as five million over the course of three days — the network started to sound a lot like Krallice. “As it improves its training, you start hearing elements of the original music it was trained on come through more and more.”As someone who used to listen to lo-fi black metal, I found Coditany of Timeness not only convincing — it sounds like a real human band — but even potentially enjoyable. The neural network managed to capture the genre’s penchant for long intros broken by frantic drums and distorted vocals. The software’s take on Krallice, which its creators filled out with song titles and album art that were also algorithmically generated, might not garner a glowing review on Pitchfork, but it’s strikingly effective at capturing the aesthetic. If I didn’t know it was generated by an algorithm, I’m not sure I’d be able to tell the difference.

Source: This frostbitten black metal album was created by an artificial intelligence | The Outline

Sopranica: an Anonymous, DIY Cell Phone Network

Posted on by

For the past few years, Gingerich has been laying the groundwork for Sopranica, an open source, DIY cell network that allows smartphone owners to make calls, send texts and eventually browse the internet with total anonymity.In January, Gingerich published the code for the first part of Sopranica called JMP. This is essentially a way of using a secure instant messaging protocol called XMPP, better known as Jabber, to communicate over voice and text from an anonymous phone number. JMP is the first phase of the Sopranica network.The next phase—called WOM—will create the physical infrastructure for the cell network with a community radio network. This will essentially involve people hosting small, inexpensive radio devices in their home that plug into their routers to provide internet access points to Sopranica users in the area.
[…]
Getting set up with JMP is easy. First, you need to create a free and anonymous Jabber ID, which is like an email address. I had already created a Jabber ID with the Chaos Computer Club (a German hacking group), but there are a lot of other servers you can register with as well. The only difference will be the web address in your Jabber ID will be different—for example, motherboard@jabber.ccc.de or motherboard@xmpp.jp.

Next, you need to install a Jabber app on your phone. I use Android and opted for Xabber, but again, there are plenty of options to choose from (Conversations is a good choice if you want to use Sopranica for picture messaging, for instance). You’ll also need to install a Session Initiation Protocol (SIP) app, which allows your phone to make calls and send texts over the internet instead of the regular cellular network. For Android users, the best choice is probably CSipSimple and for iPhones your best bet is Linphone.

Finally, it’s time to get your phone number. If you navigate to Sopranica’s JMP website, there is a list of numbers at the bottom. These phone numbers are generated by Sopranica’s Voice Over IP (VOIP) provider which provides talk and text services over the internet. Click whichever number you want to be your new number on the Sopranica network and enter your Jabber ID. A confirmation code should be sent to your phone and will appear in your Jabber app.

Once you’ve entered this code, you’re ready to use your new, anonymous number. To do this, use your SIP app and send a text or dial a number just like you would otherwise. This communication will be made through your new Sopranica number, rather than whichever cell carrier you normally use.

In many ways, JMP is kind of like getting a free VOIP number with Google Voice and then using that number to register for an account on the encrypted messaging platform Signal.
The downside of this, of course, is that the VOIP number you get from Google is registered under your name with Google, so even if the people who you communicate with using that number can’t trace it to you, Google can. On the other hand, all aspects of JMP are anonymous—neither the Jabber ID nor the JMP phone number require identifying information to register.

Source: This Interview Was Conducted on an Anonymous, DIY Cell Phone Network – Motherboard

Announcing the Initial Release of Mozilla’s Open Source Speech Recognition Model and Voice Dataset

Posted on by

I’m excited to announce the initial release of Mozilla’s open source speech recognition model that has an accuracy approaching what humans can perceive when listening to the same recordings. We are also releasing the world’s second largest publicly available voice dataset, which was contributed to by nearly 20,000 people globally.
[…]
This is why we started DeepSpeech as an open source project. Together with a community of likeminded developers, companies and researchers, we have applied sophisticated machine learning techniques and a variety of innovations to build a speech-to-text engine that has a word error rate of just 6.5% on LibriSpeech’s test-clean dataset.

In our initial release today, we have included pre-built packages for Python, NodeJS and a command-line binary that developers can use right away to experiment with speech recognition.
[…]
Our aim is to make it easy for people to donate their voices to a publicly available database, and in doing so build a voice dataset that everyone can use to train new voice-enabled applications.

Today, we’ve released the first tranche of donated voices: nearly 400,000 recordings, representing 500 hours of speech. Anyone can download this data.
[…]
To this end, while we’ve started with English, we are working hard to ensure that Common Voice will support voice donations in multiple languages beginning in the first half of 2018.

Finally, as we have experienced the challenge of finding publicly available voice datasets, alongside the Common Voice data we have also compiled links to download all the other large voice collections we know about.

Source: Announcing the Initial Release of Mozilla’s Open Source Speech Recognition Model and Voice Dataset – The Mozilla Blog

‘Grinch bots’ are stealing Christmas

Posted on by

“Bots come in and buy up all the toys and then charge ludicrous prices​ a​midst the holiday shopping bustle​,” the New York Democrat said on Sunday. “​Cyber bots ​— ​we call them ‘Grinch bots’ — ​are expanding their reach and​ ​unfairly scooping up the hottest toys your parents can’t even click buy.​”​​For example, Schumer said, the popular Fingerlings — a set of interactive baby monkey figurines that ​usually sell for around $15 — are being snagged by the scalping software and resold on secondary websites for as much as $1,000 a pop.“Grinch bots cannot be allowed to steal Christmas, or dollars, from the wallets of New Yorkers,​” he said. ​The senator said as soon as a retailer puts a hard-to-get toy — like Barbie’s Dreamhouse or Nintendo game systems — for sale on a website, a bot can snatch it up even before a kid’s parents finish entering their credit card information.The toys then end up for sale on other sites like Amazon and eBay for hundreds or even thousands of dollars more.

Source: Schumer says ‘Grinch bots’ are stealing Christmas | New York Post

Google’s AI Built its own AI That Outperforms Any Made by Humans

Posted on by

In May 2017, researchers at Google Brain announced the creation of AutoML, an artificial intelligence (AI) that’s capable of generating its own AIs.More recently, they decided to present AutoML with its biggest challenge to date, and the AI that can build AI created a ‘child’ that outperformed all of its human-made counterparts.The Google researchers automated the design of machine learning models using an approach called reinforcement learning. AutoML acts as a controller neural network that develops a child AI network for a specific task.
[…]
When tested on the ImageNet image classification and COCO object detection data sets, which the Google researchers call “two of the most respected large-scale academic data sets in computer vision,” NASNet outperformed all other computer vision systems.

According to the researchers, NASNet was 82.7 percent accurate at predicting images on ImageNet’s validation set. This is 1.2 percent better than any previously published results, and the system is also 4 percent more efficient, with a 43.1 percent mean Average Precision (mAP).

Additionally, a less computationally demanding version of NASNet outperformed the best similarly sized models for mobile platforms by 3.1 percent.

Source: Google’s AI Built its own AI That Outperforms Any Made by Humans

PayPal Says 1.6 Million Customer Details Stolen in Breach at Canadian Subsidiary

Posted on by

PayPal says that one of the companies it recently acquired suffered a security incident during which an attacker appears to have accessed servers that stored information for 1.6 million customers.The victim of the security breach is TIO Networks, a Canadian company that runs a network of over 60,000 utility and bills payment kiosks across North America. PayPal acquired TIO Networks this past July for $238 million in cash.
[…]
In a press release published in a late Friday afternoon news dump, PayPal provided more details about the incident.
A review of TIO’s network has identified a potential compromise of personally identifiable information for approximately 1.6 million customers. The PayPal platform is not impacted in any way, as the TIO systems are completely separate from the PayPal network, and PayPal’s customers’ data remains secure.

Source: PayPal Says 1.6 Million Customer Details Stolen in Breach at Canadian Subsidiary

Prison hacker who tried to free friend now likely to join him inside

Posted on by

In a sustained campaign, Voits managed to get the login details and passwords for 1,600 county employees, including for the Xjail computer system that is used to track inmates. By March he had the logins to the prison management system and tried to amend the records of one inmate to arrange their early release.

His tinkering raised red flags, however, and the authorities moved in. Once Voits’ meddling was discovered, inmate records were fixed and the county called in computer forensics, spending $235,488 to fix the mess.

Source: Prison hacker who tried to free friend now likely to join him inside